JWT Decode Encode
Decode and sign JWTs โ entirely in your browser, nothing uploaded.
Build a token
A JWT (JSON Web Token) carries a header, a payload of claims and a signature, all base64url-encoded. This free tool decodes any JWT so you can read its claims and see whether it has expired, and it can also sign a brand-new HS256 token from your own header, payload and secret. Everything happens locally using the browserโs built-in Web Crypto API, so your tokens and secrets never leave your device โ which matters, because a JWT often is the credential.
Frequently Asked Questions
How do I decode a JWT?
Paste the token into the box above and its header and payload are decoded instantly, along with badges showing the algorithm and the issued/expiry times. Nothing is uploaded โ the decoding is plain base64url parsing done locally, so it works offline and is safe for real tokens.
Is it safe to paste a real token here?
Yes. The token and any secret you enter are never transmitted anywhere โ all decoding and signing happens in your browser using the Web Crypto API, and the page keeps working with your network disconnected. That is deliberate, because a JWT is usually a live credential and pasting one into a server-side tool would leak it.
Can it verify the signature?
Yes, for HS256 tokens. Enter the shared secret and the tool re-computes the signature and tells you whether it matches, so you can confirm a token really was issued with that key. Tokens signed with RS256 or other asymmetric algorithms can still be decoded, but verifying those needs the public key and is not supported here.
How do I create a new token?
Fill in the header and payload JSON, enter a secret, and press "Sign token (HS256)". The tool builds the base64url segments and signs them with HMAC-SHA256 in your browser, producing a token you can use immediately. Use a long, random secret โ short ones are easy to brute-force.
What does "expired" mean on the badge?
The badge reads the standard "exp" claim, converts it from Unix time to a readable UTC timestamp, and compares it with your device clock. If that moment has already passed the badge turns red, which usually explains why an API is rejecting the token.